Slashdot Mirror


Diebold Election Audit Logs Defective

mtrachtenberg writes "Premier Election Solutions' (formerly Diebold) GEMS 1.18.19 election software audit logs don't record the deletion of ballots, don't always record correct dates, and can be deleted by the operator, either accidentally or intentionally. The California Secretary of State's office has just released a report about the situation (PDF) in the November 2008 election in Humboldt County, California (which we discussed at the time). Here's the California Secretary of State's links page on Diebold. The conclusion of the 13-page report reads: 'GEMS version 1.18.19 contains a serious software error that caused the omission of 197 ballots from the official results (which was subsequently corrected) in the November 4, 2008, General Election in Humboldt County. The potential for this error to corrupt election results is confined to jurisdictions that tally ballots using the GEMS Central Count Server. Key audit trail logs in GEMS version 1.18.19 do not record important operator interventions such as deletion of decks of ballots, assign inaccurate date and time stamps to events that are recorded, and can be deleted by the operator. The number of votes erroneously deleted from the election results reported by GEMS in this case greatly exceeds the maximum allowable error rate established by HAVA. In addition, each of the foregoing defects appears to violate the 1990 Voting System Standards to an extent that would have warranted failure of the GEMS version 1.18.19 system had they been detected and reported by the Independent Testing Authority that tested the system.'"

15 of 256 comments (clear)

  1. Fraud by Hatta · · Score: 5, Insightful

    Ok, so when do we get to throw Diebold exec in jail for election tampering already?

    --
    Give me Classic Slashdot or give me death!
    1. Re:Fraud by Mr.+Underbridge · · Score: 3, Insightful

      Ok, so when do we get to throw Diebold exec in jail for election tampering already?

      When you can prove intent.

      Or, put another way, "Never ascribe to malice, that which can be explained by incompetence." --N. Bonaparte

    2. Re:Fraud by Frosty+Piss · · Score: 3, Insightful

      Ok, so when do we get to throw Diebold exec in jail for election tampering already?

      The better question might be when will Diebold ask for a stimulous bail-out?

      --
      If you want news from today, you have to come back tomorrow.
    3. Re:Fraud by DrLang21 · · Score: 3, Insightful

      The only problem with this is that our government solicited for this product. As far as anyone can tell, Diebold met the quality control and traceability standards that were put in place by the US government for this type of device, which is to say THERE WERE NONE. It was unethical for Diebold to put out the product that they did, but that's not to say that it was illegal or treasonous.

      --
      I see the glass as full with a FoS of 2.
    4. Re:Fraud by Volante3192 · · Score: 3, Insightful

      Gambling machine standards. ATM standards.

      Why couldn't they just copy/paste those? It's pretty much a guarentee those are as close to bulletproof as we can make hardware. (I'd personally lean towards the video poker standards, somehow I think those are more rigorously designed than ATMs)

    5. Re:Fraud by Chelloveck · · Score: 3, Insightful

      Or, put another way, "Never ascribe to malice, that which can be explained by incompetence." --N. Bonaparte

      I generally agree with that statement, but I'm really having a hard time figuring out how anyone could be that incompetent. What does a voting machine need to do? Count ballots, and keep a record of the count. That's about it. Oh, sure, you put a nice GUI and a touch screen on it, but at its core you're simply doing "candidate++; write_log(candidate);" over and over again. And the numbers you're counting aren't even that big, relatively speaking. They're certainly not going to overflow a 32-bit integer, so you don't have to worry about roll-over.

      How can anyone be incompetent enough to screw that up? That's truly creative incompetence.

      --
      Chelloveck
      I give up on debugging. From now on, SIGSEGV is a feature.
    6. Re:Fraud by eggnoglatte · · Score: 4, Insightful

      In both ATMs and gambling machines, the operator is a trusted entity. In voting he is not. Big difference.

  2. Comment removed by account_deleted · · Score: 4, Insightful

    Comment removed based on user account deletion

  3. Re:allowed??? by JCSoRocks · · Score: 4, Insightful

    This entire situation is insane. My company's software isn't perfect but we can handle hundreds of thousands of transactions without missing one. I don't understand how you can fail so miserably at something as simple as electronic voting. The post below about it being based on an Access database melts my brain.

    --
    You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
  4. Re:allowed??? by Spacepup · · Score: 3, Insightful

    The difference is that with a paper ballot system, there is an accurate paper trail. You can't just toss out an entire block of ballots without someone finding them in the trash with a paper ballot system. But, it appears that exactly that can happen with the diebold systems.

    Diebold may not be maliciously trying to tamper with elections. They have just made it exceptionally easy to tamper with elections. They should not be trusted.

  5. The real problem by WindBourne · · Score: 5, Insightful
    Ou banking system makes heavy use of Diebold. One of two things is happening.
    1. Diebold is inept and we have mass issues in our banking systems.
    2. Diebold has PURPOSELY done this.

    I have not seen a single issue in my accounts due to ATMs.

    --
    I prefer the "u" in honour as it seems to be missing these days.
  6. Re:allowed??? by girlintraining · · Score: 3, Insightful

    There is an *allowed* number??

    In any organic process, there will be a systemic error rate. These are people we're dealing with, not machines. People get confused, they make mistakes, they get angry and other people allow those mistakes to stand, sometimes they do the right thing for the wrong reasons or the wrong thing for the right reasons. Voting is a right, but nobody ever said it's done right. That said, the goal is to make that error rate less over time, to make continuous improvements in voter education, in process control, and in effective auditing, all the while knowing that perfection is a direction not a goal.

    The problem as presented here is that the error rate grossly exceeds what previous methods had, and that this is attributable to systemic flaws, rather than the inherently higher initial error rate that would be present in the early use of any new system.

    --
    #fuckbeta #iamslashdot #dicemustdie
  7. Why Authentication is a good idea! by Zymergy · · Score: 4, Insightful

    I was very surprised this past election when I attempted to show my State Issued Photo ID card (Driver's License) and Social Security Card to prove who I was in order to vote.
    The very polite woman looked away and told me that she CANNOT look at my ID Cards because of laws/rules.
    She simply verbally asked for my name from a list of registered voters in my district, I signed my name on the blank beside my computer printed name and was handed my ballot.
    Scratching my head, I went into the both and voted. Next I returned my paper ballot card to a large scanning device and inserted it and that was 'voting' for 2008.

    What troubles me is that there was almost ZERO authentication! All I needed, was a name and to show up where that name would be likely registered and I could vote fraudulently.
    I get more authentication getting gas with mt debit card at 7-11!
    I realized that this must be ON PURPOSE. But why? All I can conclude after much though is to allow fraud.
    ->We already have a perfected system that nearly everyone already knows how to use! They are called Credit Cards!

    Why can Mastercard/Visa reliably authenticate BILLIONS of unique transactions with very little error and an audit trail and Diebold cannot?
    I believe that when the US has another election, we should be issued Visa/Mastercard Debit cards with our pictures on them linking to a database of our eligibility to vote in US elections.
    We use the same credit card/ debit card devices that are used all over which are tied to a computer touch screen, and we "purchase" a list of candidates (just like building a PC at NewEgg..) and then "purchase".
    Now I have a printed receipt that instantly confirms my choices and selections after the transaction. If I made any mistake, I will need to immediately take that receipt to the person conducting the elections with my photo ID debit card for voting, and they will assist me in correcting the errors and I will need to electronically sign a form and will be issues a correction receipt with my previous incorrect choices credited to my "account" and the my new correct selections "purchases" on the new receipt.
    of course, I will be able to later look this up online to verify my paper receipt matches the online database of my "votes" (purchases).

    Why reinvent the wheel? Mastercard/Visa have over 30 year experience conducting authenticated transactions and their fee is typically less than 3%.
    The Sause is not in the touch screens or their audit logs, it is in AUTHENTICATION and being able to reliable VERIFY your selections got registered as your choices.
    (Of course I will later expect a statement via the US Mail (built in fraud protection laws) that will exactly match my printed receipt obtained at the time of my voting...)

  8. Re:Minnesota Anyone? by Ironica · · Score: 4, Insightful

    Considering that still, several months later, the State of Minnesota is recounting paper Senate ballots over and over, is this REALLY that bad of an option?

    You mean, it's better to have an electronic system arbitrarily choose a candidate quickly, than a paper system slowly choose a candidate based on actual votes?

    --
    Don't you wish your girlfriend was a geek like me?
  9. Re:can we at the very least sue them by davester666 · · Score: 3, Insightful

    The last sentence in the summary seems to blame the testing of the provided system for not detecting that the system is defective. So, it's the customer's fault that a defective system was used, not the vendor's.

    --
    Sleep your way to a whiter smile...date a dentist!